# 10/11/2008 Activation Key Malware - Trojan horse

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"The Activation Keys - Trojan-2"; flow:established,to_server; content:"|0d 0a|Subject\: The Activation Keys"; nocase; content:"active_key.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:9036; rev:2;)